Search code examples
hashsalt-cryptography

Does a single Salt provide any additional security?


I understand that it's best practice to generate a long salt for each password you use. But does using a single salt provide any security benefit from not having a salt at all?


Solution

  • Having a shared salt makes you marginally more secure. It prevents an attacker from using a pre-computed rainbow table attack, but it does not prevent them from building a single, new rainbow table for your password database. Thus it is harder for an attacker to crack a single password with a given salt, but it is significantly easier for them to crack every password with that salt.

    As an example, consider the following simplified set of passwords, salts and hashes:

    Password  Salt     Hash
    aaaaaz    y03sar   ze4lap
    zzzzza    y03sar   enbe65
    

    The attacker knows that your salt is y03sar and starts computing every hash with that start for every password from a to zzzzzz. Long before (in terms of iterations, the actual cracking would finish very quickly for passwords and salts of this complexity) they discover the password zzzzza, they will realize they have also discovered the password aaaaaz. In other words, brute forcing one password in your database is no harder in the worst case than brute forcing every password.

    With different salts, each password must be attacked separately.

    Password  Salt     Hash
    aaaaaz    bbq9f0   i2chf1
    zzzzza    y03sar   enbe65
    

    If the attacker again starts calculating hashes for every password from a to zzzzzz with the salt y03sar, then i2chf1 won't be in their output list (at least it's improbable with a reasonable length hash output; even if it is, the computed password for salt y03sar still won't work to gain access to the aaaaaz account because the hash would be different with salt bbq9f0).

    To add some numbers to the mix, using a single salt lengthens the attack time from instantaneous (rainbow tables provide for a constant-time lookup on the hash digest) to linear time. As soon as the attacker has computed the hashes for every password allowed by your system, they have access to every account in your system. Even if you have 16 character passwords allowing [a-zA-Z0-9], then your whole system is compromised in days or weeks. (Linked question is just an example - GPU's can crack passwords even faster than the hardware in the answer.)

    Now if you have distinct salts for every password, then in the same amount of time it took an attacker to crack your entire database, they have only cracked a single password.

    That's a pretty big difference. Use unique salts. (And a good hashing algorithm, while we're on the topic.)